Signature Detail

HTTP: BMP Bad Parameter

This anomaly triggers under the following conditions: The bits per pixel field (offset 001ch) is not valid. The width (offset 0012h) OR height (offset 0016h) is greater than the threshold equal to 32,000. These incidents can indicate malicious behavior aimed at your system.

Extended Description

Mozilla Browser is reportedly prone to multiple integer overflow vulnerabilities in the image parsing routines. These issues exist due to insufficient boundary checks performed by the application. A remote attacker may cause denial of service conditions in the client or execute arbitrary code to gain unauthorized access to a vulnerable computer. These vulnerabilities were researched on Mozilla 1.7, however, other versions may be affected as well. Thunderbird 0.7 was also tested.

Affected Products

• Conectiva Linux 10.0.0
• Conectiva Linux 9.0.0
• Mozilla Browser 1.7.0
• Mozilla Browser 1.7.0 Rc3
• Mozilla Browser 1.7.1
• Mozilla Browser 1.7.2
• Mozilla Firebird 0.5.0
• Mozilla Firefox 0.8.0
• Mozilla Firefox 0.9.0
• Mozilla Firefox 0.9.0 Rc
• Mozilla Firefox 0.9.1
• Mozilla Firefox 0.9.2
• Mozilla Firefox 0.9.3
• Mozilla Thunderbird 0.6.0
• Mozilla Thunderbird 0.7.0
• Mozilla Thunderbird 0.7.1
• Mozilla Thunderbird 0.7.2
• Mozilla Thunderbird 0.7.3
• Netscape Navigator 7.0.0
• Netscape Navigator 7.0.2
• Netscape Navigator 7.1.0
• Netscape Navigator 7.2.0
• Red Hat Advanced Workstation for the Itanium Processor 2.1.0
• Red Hat Advanced Workstation for the Itanium Processor 2.1.0 IA64
• Red Hat Desktop 3.0.0
• Red Hat Enterprise Linux AS 2.1
• Red Hat Enterprise Linux AS 2.1 IA64
• Red Hat Enterprise Linux AS 3
• Red Hat Enterprise Linux ES 2.1
• Red Hat Enterprise Linux ES 2.1 IA64
• Red Hat Enterprise Linux ES 3
• Red Hat Enterprise Linux WS 2.1
• Red Hat Enterprise Linux WS 2.1 IA64
• Red Hat Enterprise Linux WS 3
• Red Hat Fedora Core1
• Red Hat Linux 7.3.0
• Red Hat Linux 7.3.0 I386
• Red Hat Linux 7.3.0 I686
• Red Hat Linux 9.0.0 I386

References

• BugTraq: 11171
• CVE: CVE-2004-0904
• URL: http://www.kb.cert.org/vuls/id/847200
• URL: http://atlc.sourceforge.net/bmp.html